LLM frameworks · Open WebUI
Open WebUI
Self-hosted chat UI for Ollama and OpenAI-compatible APIs.
5Advisories
0critical
5high
0medium
2026-10-12Latest
Timeline · advisories per quarter
12026 Q2
32026 Q3
12026 Q4
Named in sources
Reported for Open WebUI
01. CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminIn Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies. Open WebUI 2026-10-12 02. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 03. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 04. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 05. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14
Open WebUI 2026-10-12 02. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 03. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 04. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 05. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14